#IstioCon Apache APISIX from Gateway to Full Traffic Proxy with Istio Jintao Zhang API7.ai #IstioCon About Me ● Apache APISIX PMC ● Kubernetes Ingress NGINX maintainer ● Microsoft MVP ● zhangjintao@apache https://github.com/api7/amesh #IstioCon How to use it Change the injection-template: ● proxy_init ● proxy Ref: https://github.com/api7/amesh/blob/main/docs/en/demo.md #IstioCon The future ● Donate

Remote，主与备 • 轻量级客户端、本地调用 • Local Proxy负责服务治理与 远程通信 • Remote Proxy负责备份和非 主流流量 JavaApp Local Proxy OSP Server Service Registry Service Config Center Remote Proxy Cluster API Gateway 备用链路 服务发现 • Local & Remote • 根据接入对象的不同，制定 不同的接入策略，达到 • 接入简单 • 保证性能 • 节省资源 Java App Local Proxy OSP Server Remote Proxy Cluster Thrift over TCP PHP App C/C++/Node JS App Thrift over TCP Thrift over 服务端受限于Proxy支持的协 议（目前只支持HTTP 1.1） Local Proxy Web Server Service Registry API Gateway 健康检查 服务注册 Registry agent 服务发现 HTTP/JSON HTTP/JSON容器化 • Proxy Daemonset • 每台宿主机一台Proxy • Proxy地址文件 •

use conda on Windows XP, select Anaconda 2.3.0 and see Using conda on Windows XP with or without a proxy. GUI versus command line installer Both GUI and command line installers are available for Windows dependency (add_pip_as_python_dependency) – Use pip (use_pip) – Configure conda for use behind a proxy server (proxy_servers) – SSL verification (ssl_verify) – Offline mode only (offline) • Advanced configuration advanced users to configure various aspects of conda, such as which channels it searches for packages, proxy settings and environment directories. The .condarc file is not included by default, but it is automatically

use conda on Windows XP, select Anaconda 2.3.0 and see Using conda on Windows XP with or without a proxy. GUI versus command line installer Both GUI and command line installers are available for Windows dependency (add_pip_as_python_dependency) – Use pip (use_pip) – Configure conda for use behind a proxy server (proxy_servers) – SSL verification (ssl_verify) – Offline mode only (offline) • Advanced configuration advanced users to configure various aspects of conda, such as which channels it searches for packages, proxy settings and environment directories. The .condarc file is not included by default, but it is automatically

个单独 的二进制。 pilot-agent跟envoy打包在同一个docker镜 像里，镜像由Dockerfile.proxy定义， Makefile（include了tools/istio- docker.mk）把这个dockerfile build成了 ${HUB}/proxy:${TAG}镜像，也就是 Kubernetes里跟应用放在同一个pod下的 sidecar。非Kubernetes情况下需要把 况下需要把 pilot-agent、envoy跟应用部署在一起，这 就有点“污染”应用的意思了。Pilot-Agent的功能介绍 在proxy镜像中，pilot-agent负责的工作包括： • 生成envoy的配置。 • 启动envoy。 • 监控并管理envoy的运行状况，比如envoy出错时pilot-agent负责重启envoy，或者envoy配置变更后 reload envoy。 t istio sidecar）， inject过程中，除了proxy镜像作为sidecar之外，每个pod还会带上initcontainer（Kubernetes中的概 念），具体镜像为proxy_init。proxy_init通过注入iptables规则改写流入流出pod的网络流量规则，使得 流入流出pod的网络流量重定向到proxy的监听端口，而应用对此无感。Init Container的工作原理

force_ip_resolve form_params headers http_errors idn_conversion json multipart on_headers on_stats progress proxy query read_timeout sink ssl_key stream synchronous verify timeout version Guzzle and PSR-7 Headers for the maximum duration of the timeout. HTTP_PROXY Defines the proxy to use when sending requests using the "http" protocol. Note: because the HTTP_PROXY variable may contain arbitrary user input on more information. HTTPS_PROXY Defines the proxy to use when sending requests using the "https" protocol. NO_PROXY Defines URLs for which a proxy should not be used. See proxy for usage. Relevant ini

force_ip_resolve form_params headers http_errors idn_conversion json multipart on_headers on_stats progress proxy query read_timeout sink ssl_key stream synchronous verify timeout version Guzzle and PSR-7 Headers for the maximum duration of the timeout. HTTP_PROXY Defines the proxy to use when sending requests using the "http" protocol. Note: because the HTTP_PROXY variable may contain arbitrary user input on more information. HTTPS_PROXY Defines the proxy to use when sending requests using the "https" protocol. NO_PROXY Defines URLs for which a proxy should not be used. See proxy for usage. Relevant ini

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25 1.3.21 proxy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26 i for the maximum duration of the timeout. HTTP_PROXY Defines the proxy to use when sending requests using the “http” protocol. Note: because the HTTP_PROXY variable may contain arbitrary user input on some more information. HTTPS_PROXY Defines the proxy to use when sending requests using the “https” protocol. NO_PROXY Defines URLs for which a proxy should not be used. See proxy for usage. 1.2. Quickstart

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25 1.3.21 proxy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25 i for the maximum duration of the timeout. HTTP_PROXY Defines the proxy to use when sending requests using the “http” protocol. Note: because the HTTP_PROXY variable may contain arbitrary user input on some more information. HTTPS_PROXY Defines the proxy to use when sending requests using the “https” protocol. NO_PROXY Defines URLs for which a proxy should not be used. See proxy for usage. Relevant ini

nst_iterator> size_type implementation-de�ned difference_type implementation-de�ned reference proxy class representing a reference to a single bool (class) const_reference bool pointer implementation-de�ned implementation-de�ned difference_type difference_type implementation-de�ned implementation-de�ned reference proxy class representing a reference to a single bool (class) const_reference bool pointer pointer implementation-de�ned nst_iterator> size_type implementation-de�ned difference_type implementation-de�ned reference proxy class representing a reference to a single bool (class) const_reference const_reference bool bool